UU - IT - UDBL 1 E-COMMERCE and SECURITY - 1DL018 Spring 2008 An introductury course on e-commerce systems alt. http://www.it.uu.se/edu/course/homepage/ehandel/vt08/ Kjell Orsborn Uppsala Database Laboratory Department of Information Technology, Uppsala University, Uppsala, Sweden Kjell Orsborn 4/24/08 UU - IT - UDBL 2 Web Servers ch 6, 7 Kjell Orsborn Department of Information Technology Uppsala University, Uppsala, Sweden Kjell Orsborn 4/24/08 UU - IT - UDBL 3 Web clients and Web servers Clients running browsers Web server Requests sent pages received Kjell Orsborn 4/24/08 UU - IT - UDBL 4 Web server • The term web server can mean one of two things: – A computer program that is responsible for accepting HTTP requests from clients, which are known as web browsers, and serving them HTTP responses along with optional data contents, which usually are web pages such as HTML documents and linked objects (images, etc.). – A computer that runs a computer program as described above. Kjell Orsborn 4/24/08 UU - IT - UDBL 5 Common features of Web servers • Web server programs might differ in detail, but they all share some basic common features: – HTTP: every web server program operates by accepting HTTP requests from the client, and providing an HTTP response to the client. • The HTTP response usually consists of an HTML document, but can also be a raw file, an image, or some other type of document (defined by MIME-types). – Logging: usually web servers have also the capability of logging some detailed information, about client requests and server responses, to log files; • this allows the webmaster to collect statistics by running log analyzers on log files. • In practice many web servers also implement other features including: – Authentication, optional authorization request (request of user name and password) before allowing access to some or all kind of resources. – Handling of static content (file content recorded in server's filesystem(s)) and dynamic content by supporting interfaces such as SSI, CGI, SCGI, FastCGI, JSP, PHP, ASP, ASP .NET, Server API (NSAPI, ISAPI, Apache API) etc. – HTTPS support (by SSL or TLS) to allow secure (encrypted) connections to the server on the standard port 443 instead of usual port 80. – Content compression (i.e. by gzip encoding) to reduce the size of the responses. – Virtual hosting to serve many web sites using one IP address. Kjell Orsborn 4/24/08 UU - IT - UDBL 6 Origin of returned content • The origin of the content sent by server is called: – static if it comes from an existing file lying on a filesystem; – dynamic if it is dynamically generated by some other program or script or Application Programming Interface called by the web server. • Serving static content is usually much faster (from 2 to 100 times) than serving dynamic content, especially if the latter involves data pulled from a database. Kjell Orsborn 4/24/08 UU - IT - UDBL 7 Path translation • Web servers are able to map the path component of a Uniform Resource Locator (URL) into: – a local file system resource (for static requests); – an internal or external program name (for dynamic requests). • For a static requests, the URL path specified by the client is relative to the Web server's root directory. – Consider the following URL as it would be requested by a client: – http://www.example.com/path/file.html – The client's web browser will translate it into a connection to www.example.com with the following HTTP 1.1 request: – GET /path/file.html HTTP/1.1 Host: www.example.com – The web server on www.example.com will append the given path to the path of its root directory. On Unix machines, this is commonly /var/www/htdocs. – The result is the local file system resource: – /var/www/htdocs/path/file.html • The web server will then read the file and send a response to the client's web browser. – The response will describe the content of the file and contain the file itself. Kjell Orsborn 4/24/08 UU - IT - UDBL 8 Frequent web server (partial list) • Netcraft Web Server Survey (http://survey.netcraft.com/Reports/200801/) Kjell Orsborn 4/24/08 UU - IT - UDBL 9 Web markup languages • HTML: HyperText Markup Language, is the predominant markup language for web pages. – It provides a means to describe the structure of text-based information in a document by denoting certain text as links, headings, paragraphs, lists, etc. – Furthermore, text can be and supplemented with interactive forms, embedded images, and other objects. – HTML can to some degree describe the appearance and semantics of a document, and can include embedded scripting language code affecting the behavior of web browsers. – HTML is also used to refer to content of the MIME type text/html or even more broadly as a generic term for HTML whether in its XML-descended form (such as XHTML 1.0 and later) or its form descended directly from SGML (such as HTML 4.01 and earlier). • XML: The Extensible Markup Language is a general-purpose markup language. – It is classified as an extensible language because it allows its users to define their own elements. Its primary purpose is to facilitate the sharing of structured data across different information systems, particularly via the Internet. • XHTML: The Extensible HyperText Markup Language – It is a markup language with the same depth of expression as HTML but conforming to XML syntax. • DHTML: Dynamic HTML is a collection of technologies used together to create interactive and animated web sites. – This include a static markup language (such as HTML), a client-side scripting language (such as JavaScript), a presentation definition language (Cascading Style Sheets, CSS), and the Document Object Model (DOM). Kjell Orsborn 4/24/08 UU - IT - UDBL 10 URI:s, URL:s & URN:s • In computing, a Uniform Resource Identifier (URI), is a compact string of characters used to identify or name a resource. The main purpose of this identification is to enable interaction with representations of the resource over a network, typically the World Wide Web, using specific protocols. • A URI may be classified as a locator (URL) or a name (URN) or both. • URI:s can refer to web pages, mail, newsgroups, FTP etc. • An example of a URL: http://www.it.uu.se/edu/course/homepage/ehandel/vt08/ Specifies location of Web page Specifies Web page Specifies computer Kjell Orsborn 4/24/08 UU - IT - UDBL 11 HTTP - Hypertext Transfer Protocol • Hypertext Transfer Protocol (HTTP) is a communications protocol for the transfer of information on intranets and the World Wide Web. Its original purpose was to provide a way to publish and retrieve hypertext pages over the Internet between web server and web client. • HTTP is a request/response protocol standard between a client and a server. A client is the end-user, the server is the web site. The client makes an HTTP request using a web browser, spider, or other end-user tool. • Typically, an HTTP client initiates a request. It establishes a Transmission Control Protocol (TCP) connection to a particular port on a host (port 80 by default). An HTTP server listening on that port waits for the client to send a request message. Upon receiving the request, the server sends back a status line, such as "HTTP/1.1 200 OK", and a message of its own, the body of which is perhaps the requested file, an error message, or some other information. • Resources to be accessed by HTTP are identified using Uniform Resource Identifiers (URIs) (or, more specifically, Uniform Resource Locators (URLs)) using the http: or https: URI schemes. Kjell Orsborn 4/24/08 UU - IT - UDBL 12 An example of a request I want this page GET /index.html HTTP/1.1 User-Agent: Lynx/2.4 Connection: Keep-Alive I am using Host: www.openaccess.com this browser Accept: text/html Keep the connection live Accept only text/HTML This is the computer on which the page resides Kjell Orsborn 4/24/08 UU - IT - UDBL 13 An example of a reply Server using version 1.1 of HTTP Client request successful HTTP/1.1 200 OK When Date: Thu, 22 July 1998 18:40:55 GMT request Server: Apache 1.3.5 (Unix) PHP/3.0.6 satisfied Last-Modified: Mon, 19 July 1997 16:03:22 GMT Content-Type: text/html Content-Length: 12987 ... When page Server last modified used Type of content Length of content (bytes) Kjell Orsborn 4/24/08 UU - IT - UDBL 14 HTTP commands & status codes • Some HTTP commands: • GET Get a file from a Web server • HEAD Like GET no content sent just header info • POST Invoke a program on a form • PUT Store some resource • DELETE Deletes the specified resource • OPTIONS Find out about communication options • CONNECT Convert request connection to transparent TCP/IP tunnel • Status codes: – Indicates the result of a request – Starting with 2 mean correct response – Starting with 3 means browser has to carry out some other action – Starting with 4 means there is a problem, normally the page cannot be found (Error 404) – Starting with a 5 indicates a serious server problem Kjell Orsborn 4/24/08 UU - IT - UDBL 15 Web Forms • A webform on a web page allows a user to enter data that is, typically, sent to a server for processing and to mimic the usage of paper forms. – Forms can be used to submit data to save on a server (e.g. ordering a product) or can be used to retrieve data (e.g. searching on a search engine). • XHTML/HTML forms – A form in XHTM or HTML is by far the most common way to use a form online.